178.20.31.166

(mod_security) mod_security (id:210350) triggered by 178.20.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 11:58:25.353207 2026] [security2:error] [pid 22973:tid 22973] [client 178.20.31.166:58477] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 11:58:25.353207 2026] [security2:error] [pid 22973:tid 22973] [client 178.20.31.166:58477] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/tags/523"] [unique_id "auS-oRTf3udzzPRUSJbQqwAAAAc"] show less

(mod_security) mod_security (id:210350) triggered by 178.20.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 09:44:37.249300 2026] [security2:error] [pid 22818:tid 22818] [client 178.20.31.166:30329] M ... show more (mod_security) mod_security (id:210350) triggered by 178.20.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 09:44:37.249300 2026] [security2:error] [pid 22818:tid 22818] [client 178.20.31.166:30329] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tulsatvmemories.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tulsatvmemories.com"] [uri "/weather.html"] [unique_id "auSfRZrIbCf67phIZGdFsgAAAAY"] show less

(mod_security) mod_security (id:210350) triggered by 178.20.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:19:58.063874 2026] [security2:error] [pid 9513:tid 9513] [client 178.20.31.166:33215] Mod ... show more (mod_security) mod_security (id:210350) triggered by 178.20.31.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:19:58.063874 2026] [security2:error] [pid 9513:tid 9513] [client 178.20.31.166:33215] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bostonlog.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bostonlog.com"] [uri "/category/indiana/"] [unique_id "auNkHuqXw-vyUbtDGa7K5gAAAAg"] show less

2026/10/12 15:14:03 "GET /wp-login.php?action=register HTTP/1.1"

Fail2Ban: WordPress brute-force attack detected.

repeated unauthorized VPN login attempt, user sweep

repeated unauthorized VPN login attempt, user sweep

Trying to access config files

Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.166 2026-09-10T03:16:33+02:00 vpn Access-Reject 'mei' station: 178.20.31.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.166 2026-09-09T18:37:01+02:00 vpn Access-Reject 'd_turczyn' station: 178.20.31.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 178.20.31.166 2026-09-09T18:37:01+02:00 vpn Access-Reject 'd_turczyn' station: 178.20.31.166 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

Web App Attack

HTTP flood against /retreat-corp on Apache webserver

[FriMay0808:29:54.0092662026][security2:error][pid185886:tid186163][client178.20.31.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"xmlrpc\\\\\\\\.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/03_asl_dos.conf\"][line\"6 ... show more [FriMay0808:29:54.0092662026][security2:error][pid185886:tid186163][client178.20.31.166:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"xmlrpc\\\\\\\\.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_rules/03_asl_dos.conf\"][line\"65\"][id\"392331\"][rev\"3\"][msg\"Atomicorp.comWAFRules:xmlrpcDOSattack\"][severity\"CRITICAL\"][hostname\"motogiro.com\"][uri\"/xmlrpc.php\"][unique_id\"af2C4pT4N10lFESvdam1JgAAARQ\"] show less

Web App Attack